“EU policy experts say not to worry about CRA compliance because the EU standards bodies will streamline it. But the European Standardisation Organizations (ESO) are corporate-controlled, patent-loving and expensive to engage.”
The EU’s answer to Open Source worries about the Cyber Resilience Act is that standards bodies will sort out compliance. CEN and CENELEC answer to national industries, and ETSI runs on high membership fees and secret proceedings. None of them consult Open Source charities. The fallback is paying third-party auditors, which volunteer projects cannot afford and the companies writing the standards can.